Certificate to secure 100 plus SD WAN PANFW management interface for webui

[Daniel_Li]

All

I plan to secure web interface for management of PANFW. we use data plane IP to manage all FWs.  Is there way to deploy certs to each PAN via Panorama or it has to be done one by one. If any one did this before Please help and share

Thank you

Daniel

[iarobertson]

Hello @Daniel_Li - do you have an enterprise CA that you can leverage?  If so, and if you're fine with all of the firewalls having the same certificate on them, you could use a SAN certificate, or a wildcard certificate.  The instructions here may help you. 

If you need each device to have its own certificate, you may have some luck in automating the process via the CLI, but I'm not aware of any existing supported scripts to do this. 

[Daniel_Li]

Thank you Iain for your kind reply. We have Microsoft CA. Will try the link. Other question you could help answer. we are using loopback interface for webui access and managed by Panorama (not using management plane interface). How to implement SSL profile to loopback interface to secure it

Thank you

[iarobertson]

Hello @Daniel_Li - please refer to this knowledgebase article; once SSL is set up, it is valid for all WebUI sessions.

[Daniel_Li]

Thank you Iain. SSL profile works not only for management interface but other webui sessions. I will test. 

Daniel

[Daniel_Li]

Iain

I was told by Tech that SSL profile can not be applied to loopback interface in the data plane. Only to management interface in the management

plane. I have not tested but it seems to be correct technically 

Daniel